de.hybris.platform.servicelayer.web

Class XSSRequestWrapper

java.lang.Object

HttpServletRequestWrapper

de.hybris.platform.servicelayer.web.XSSRequestWrapper

public class XSSRequestWrapper
extends HttpServletRequestWrapper

HttpServletRequestWrapper that sanitize requests inputs to mitigate risks of XSS scripts being passed over. This code is based on free and non-restricted code found at: http://ricardozuasti.com/2012/stronger-anti-cross-site-scripting-xss-filter-for-java-web-apps/ Some notes on performance: in order to avoid re-scanning of parameter and header values we're caching sanitized results as soon as a single call to getParameterMap() or getHeaders(String) has occurred. Also note that we try to avoid the creation of new string arrays or enumerations in case of no pattern matches.

Constructor Summary

Constructors

Constructor and Description
XSSRequestWrapper(HttpServletRequest servletRequest, Map<String,String[]> strippedHeadersMap, Map<String,String[]> strippedParametersMap) Constructor for creating a request wrapper using already processed parameter and header values.
XSSRequestWrapper(HttpServletRequest servletRequest, XSSFilter.XSSValueTranslator translator) Constructor for creating a lazy-translating request wrapper.

Method Summary

Modifier and Type	Method and Description
protected void	ensureHeadersTranslated()
protected void	ensureParametersTranslated()
String	getHeader(String name)
Enumeration	getHeaders(String name)
String	getParameter(String parameter)
Map	getParameterMap()
String[]	getParameterValues(String parameter)
protected boolean	headersAlreadyTranslated()
protected boolean	headersAreClean()
protected boolean	parametersAreClean()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

XSSRequestWrapper

public XSSRequestWrapper(HttpServletRequest servletRequest,
                         XSSFilter.XSSValueTranslator translator)

Constructor for creating a lazy-translating request wrapper. Note that parameter or header values are stripped on first read access.

XSSRequestWrapper

public XSSRequestWrapper(HttpServletRequest servletRequest,
                         Map<String,String[]> strippedHeadersMap,
                         Map<String,String[]> strippedParametersMap)

Constructor for creating a request wrapper using already processed parameter and header values.

Method Detail

getParameterValues

public String[] getParameterValues(String parameter)

getParameter

public String getParameter(String parameter)

getParameterMap

public Map getParameterMap()

parametersAreClean

protected boolean parametersAreClean()

ensureParametersTranslated

protected void ensureParametersTranslated()

getHeader

public String getHeader(String name)

getHeaders

public Enumeration getHeaders(String name)

ensureHeadersTranslated

protected void ensureHeadersTranslated()

headersAlreadyTranslated

protected boolean headersAlreadyTranslated()

headersAreClean

protected boolean headersAreClean()